ci: update NVSkills CI request workflow

[willkill07]

Overview

Updates the NVSkills CI request workflow to trigger on pull request lifecycle events and use the pinned team-request reusable workflow revision.

• I confirm this contribution is my own work, or I have the right to submit it under this project's license.
• I searched existing issues and open pull requests, and this does not duplicate existing work.

Details

• Add pull request triggers for opened, reopened, synchronize, and ready_for_review events.
• Allow pull request events to request NVSkills CI.
• Grant the reusable workflow read access to commit statuses.
• Pin the reusable workflow to the requested 2026-08-07 main revision.

Where should the reviewer start?

Start with .github/workflows/request-nvskills-ci.yml.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Relates to: none

Summary by CodeRabbit

• Chores
  • Updated pull request automation to run on pull request events.
  • Improved workflow permissions for status checks.
  • Pinned the reusable workflow to a specific version for more consistent builds.

[coderabbitai]

Walkthrough

The NVSkills CI workflow now runs for selected pull request events. It accepts pull request events in the request job condition, grants read access to commit statuses, and pins the reusable workflow to a commit.

Changes

NVSkills CI workflow

Layer / File(s)	Summary
Update workflow triggers and execution contract .github/workflows/request-nvskills-ci.yml	The workflow adds selected pull request triggers and includes pull request events in the request job condition. It adds statuses: read permission and pins the reusable workflow to a commit SHA.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses the allowed ci type, an imperative summary, lowercase formatting, and 39 characters without a trailing period.
Description check	✅ Passed	The description includes all required sections, completed confirmation checkboxes, implementation details, reviewer guidance, and a Relates to entry.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/request-nvskills-ci.yml:
- Around line 9-16: Update the `request` workflow so `pull_request` events are
handled consistently: either configure the pinned `team-request.yml` callee to
dispatch NVSkills CI for pull requests, or remove `pull_request` from the
workflow trigger and its corresponding `request` condition. Ensure no pull
request can enter the required-status path without a matching NVSkills dispatch.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: f3847a2f-6702-43e0-8716-35b3c8b95253

📥 Commits

Reviewing files that changed from the base of the PR and between d27a20e and a1775d6.

📒 Files selected for processing (1)

• .github/workflows/request-nvskills-ci.yml

📜 Review details

🧰 Additional context used

📓 Path-based instructions (3)

.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)

.github/workflows/*.{yml,yaml}: Put permissions: on each job that needs token access.
Avoid workflow-level permissions: unless the repository intentionally centralizes them and the inheritance tradeoff is documented.
Keep third-party actions pinned to full commit SHAs and preserve the readable version comment after the SHA.
Prefer action-native or ecosystem-native caching over generic actions/cache.
Use lockfiles or dependency manifests to drive cache invalidation.
Keep deploy and publish permissions isolated to the jobs that need them.
Read both caller and callee when a workflow uses workflow_call.
Put release-tag validation in the earliest practical caller job when the pipeline has tag-based publish behavior.
Keep pure-Python plugin SDK packaging as a single wheel artifact instead of duplicating it across every platform matrix entry.
contents: read is the default minimum for checkout-based build, test, docs, and packaging jobs.
pull-requests: read is required for PR metadata lookup jobs.
pages: write and id-token: write should be limited to Pages deployment jobs and any caller that invokes them through a reusable workflow.
For reusable workflows, the caller must grant every permission the called jobs require; the callee cannot elevate beyond what the caller provides.
Prefer astral-sh/setup-uv cache support with cache-dependency-glob anchored to uv.lock.
Prefer Swatinem/rust-cache with explicit shared-key and workspaces instead of ad hoc target-directory caching.
Avoid caching generated outputs that can hide stale behavior unless the repo already relies on them deliberately.

Keep CI workflow commands and package references in GitHub Actions workflows aligned with the current install, build, and example commands.

Files:

• .github/workflows/request-nvskills-ci.yml

{justfile,codecov.yml,codecov.yaml,.github/workflows/**/*.yml,.github/workflows/**/*.yaml}

📄 CodeRabbit inference engine (.agents/skills/maintain-dynamic-plugins/SKILL.md)

justfile, Codecov, and CI package/test workflows must include new plugin crates and packages.

Files:

• .github/workflows/request-nvskills-ci.yml

{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}

⚙️ CodeRabbit configuration file

{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}: Review automation changes for reproducibility, pinned versions where appropriate, secret handling, and consistency with the documented validation matrix.
Pay attention to commands that need generated native artifacts, FFI libraries, or platform-specific environment variables.

Files:

• .github/workflows/request-nvskills-ci.yml

🧠 Learnings (1)

📚 Learning: 2026-05-03T04:23:07.497Z

Learnt from: willkill07
Repo: NVIDIA/NeMo-Flow PR: 46
File: .github/workflows/ci_rust.yml:31-64
Timestamp: 2026-05-03T04:23:07.497Z
Learning: In GitHub Actions workflow YAML, it’s valid to conditionally disable a service container by setting the service container’s `image` to an empty string (`''`) via a matrix variable (e.g., `redis_service_image: ''`). This intentionally makes the runner skip service initialization for that matrix entry rather than failing the job. When reviewing workflows, don’t flag this as an error if the workflow uses an empty `image` to disable the service on specific matrix entries (e.g., OS-specific setups); verify the `image` is sourced from the matrix variable and that the service is only expected to be available when a non-empty image is provided.

Applied to files:

• .github/workflows/request-nvskills-ci.yml

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

ref=053f17aaf44aca0291cf7f62525bb39d581648d6
curl -fsSL \
  "https://raw.githubusercontent.com/NVIDIA/skills/${ref}/.github/workflows/team-request.yml" |
  grep -nE "require-nvskills-ci:|request:|github.event_name == 'pull_request'|github.event_name == 'issue_comment'|github.event_name == 'push'"

Repository: NVIDIA/NeMo-Relay

Length of output: 392

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

caller=".github/workflows/request-nvskills-ci.yml"
ref=053f17aaf44aca0291cf7f62525bb39d581648d6
callee_url="https://raw.githubusercontent.com/NVIDIA/skills/${ref}/.github/workflows/team-request.yml"

printf '%s\n' '--- caller ---'
cat -n "$caller"

printf '%s\n' '--- pinned callee ---'
curl -fsSL "$callee_url" | cat -n

Repository: NVIDIA/NeMo-Relay

Length of output: 11077

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

ref=053f17aaf44aca0291cf7f62525bb39d581648d6
url="https://raw.githubusercontent.com/NVIDIA/skills/${ref}/.github/workflows/require-nvskills-status.yml"

curl -fsSL "$url" | cat -n

Repository: NVIDIA/NeMo-Relay

Length of output: 14080

---

Route pull_request events to NVSkills CI dispatch

If pull_request events must start validation, update the pinned team-request.yml callee to dispatch for pull_request. The current callee only dispatches for issue_comment and signed push; pull requests enter the required-status job, which fails after the missing-status grace period when no NVSkills status exists. Alternatively, remove the pull_request trigger.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/request-nvskills-ci.yml around lines 9 - 16, Update the
`request` workflow so `pull_request` events are handled consistently: either
configure the pinned `team-request.yml` callee to dispatch NVSkills CI for pull
requests, or remove `pull_request` from the workflow trigger and its
corresponding `request` condition. Ensure no pull request can enter the
required-status path without a matching NVSkills dispatch.

Sources: Path instructions, MCP tools